Close
  • Latest News
  • Artificial Intelligence
  • Video
  • Big Data and Analytics
  • Cloud
  • Networking
  • Cybersecurity
  • Applications
  • IT Management
  • Storage
  • Sponsored
  • Mobile
  • Small Business
  • Development
  • Database
  • Servers
  • Android
  • Apple
  • Innovation
  • Blogs
  • PC Hardware
  • Reviews
  • Search Engines
  • Virtualization
Read Down
Sign in
Close
Welcome!Log into your account
Forgot your password?
Read Down
Password recovery
Recover your password
Close
Search
Logo
Logo
  • Latest News
  • Artificial Intelligence
  • Video
  • Big Data and Analytics
  • Cloud
  • Networking
  • Cybersecurity
  • Applications
  • IT Management
  • Storage
  • Sponsored
  • Mobile
  • Small Business
  • Development
  • Database
  • Servers
  • Android
  • Apple
  • Innovation
  • Blogs
  • PC Hardware
  • Reviews
  • Search Engines
  • Virtualization
More
    Home Applications
    • Applications
    • Cybersecurity

    HP Fortifies Static Code Analysis

    Written by

    Sean Michael Kerner
    Published August 28, 2013
    Share
    Facebook
    Twitter
    Linkedin

      eWEEK content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.

      Hewlett-Packard is updating its Fortify Static Code Analyzer (SCA) to version 4.0, boosting both the performance, accuracy and feature set of the security and code quality tool.

      Static Analysis refers to the examination of code at rest that is not actually running. Such an analysis can often find programmatic code errors that can impact code execution as well as security.

      The SCA 4.0 version is 10 times faster at code analysis than prior releases, Mike Armistead, vice president and general manager, Enterprise Security Products for HP’s Fortify division, told eWEEK. Armistead is a co-founder of Fortify, a company that HP acquired in 2010 for its source-code analysis capabilities.

      SCA 4.0 is able to scan source code in 21 different programming languages as well as their associated programming frameworks.

      “SCA is all about stitching together an application and giving you an idea of how data may flow through and how functions are used,” Armistead explained.

      With the 4.0 release, in addition to the speed boost, there has also been a 20 percent accuracy improvement in code analysis, which means that there will now be fewer false positives for code defects, he said.

      In the early days of static analysis, one of the primary defects that was caught is a coding flaw known as a “null pointer.” A null pointer is a code element where a program is trying to access a memory location that doesn’t exist. That flaw can lead to stability and security problems.

      While SCA 4.0 will detect null pointers, Armistead noted that those types of errors are more common in the C and C++ programming language than in other languages. As Java and .NET language use has proliferated, there are fewer null pointer defects due to features in those languages that mitigate the risks of the same kinds of memory issues.

      “The adversary has now also moved on,” Armistead said. “They have moved on to Cross Site Scripting and Cross Site Request Forgery as well as other categories of flaws that have not been as easily recognized by developers.”

      SCA 4.0 has its own built-in analysis engine and it also benefits from a quarterly update from HP that delivers intelligence on secure coding rules, Armistead said. HP’s security intelligence has insight into how new forms of attack are taking place and is able to pass along that information to help developers write more secure code.

      In the modern development world, a key area of focus for SCA 4.0 is on mobile development, including both Apple iOS and Google Android.

      “There are vulnerabilities that are unique to mobile apps,” Armistead said.

      The reality is also that even though mobile development and new programming frameworks have emerged over the years, many of the coding mistakes that static analysis can find are the same year-after-year.

      “I wish it were sexier than this, but development organizations keep making the same mistakes,” Armistead said.

      Sean Michael Kerner is a senior editor at eWEEK and InternetNews.com. Follow him on Twitter @TechJournalist.

      Sean Michael Kerner
      Sean Michael Kerner
      Sean Michael Kerner is an Internet consultant, strategist, and writer for several leading IT business web sites.

      Get the Free Newsletter!

      Subscribe to Daily Tech Insider for top news, trends & analysis

      Get the Free Newsletter!

      Subscribe to Daily Tech Insider for top news, trends & analysis

      MOST POPULAR ARTICLES

      Artificial Intelligence

      9 Best AI 3D Generators You Need...

      Sam Rinko - June 25, 2024 0
      AI 3D Generators are powerful tools for many different industries. Discover the best AI 3D Generators, and learn which is best for your specific use case.
      Read more
      Cloud

      RingCentral Expands Its Collaboration Platform

      Zeus Kerravala - November 22, 2023 0
      RingCentral adds AI-enabled contact center and hybrid event products to its suite of collaboration services.
      Read more
      Artificial Intelligence

      8 Best AI Data Analytics Software &...

      Aminu Abdullahi - January 18, 2024 0
      Learn the top AI data analytics software to use. Compare AI data analytics solutions & features to make the best choice for your business.
      Read more
      Latest News

      Zeus Kerravala on Networking: Multicloud, 5G, and...

      James Maguire - December 16, 2022 0
      I spoke with Zeus Kerravala, industry analyst at ZK Research, about the rapid changes in enterprise networking, as tech advances and digital transformation prompt...
      Read more
      Video

      Datadog President Amit Agarwal on Trends in...

      James Maguire - November 11, 2022 0
      I spoke with Amit Agarwal, President of Datadog, about infrastructure observability, from current trends to key challenges to the future of this rapidly growing...
      Read more
      Logo

      eWeek has the latest technology news and analysis, buying guides, and product reviews for IT professionals and technology buyers. The site’s focus is on innovative solutions and covering in-depth technical content. eWeek stays on the cutting edge of technology news and IT trends through interviews and expert analysis. Gain insight from top innovators and thought leaders in the fields of IT, business, enterprise software, startups, and more.

      Facebook
      Linkedin
      RSS
      Twitter
      Youtube

      Advertisers

      Advertise with TechnologyAdvice on eWeek and our other IT-focused platforms.

      Advertise with Us

      Menu

      • About eWeek
      • Subscribe to our Newsletter
      • Latest News

      Our Brands

      • Privacy Policy
      • Terms
      • About
      • Contact
      • Advertise
      • Sitemap
      • California – Do Not Sell My Information

      Property of TechnologyAdvice.
      © 2024 TechnologyAdvice. All Rights Reserved

      Advertiser Disclosure: Some of the products that appear on this site are from companies from which TechnologyAdvice receives compensation. This compensation may impact how and where products appear on this site including, for example, the order in which they appear. TechnologyAdvice does not include all companies or all types of products available in the marketplace.

      ×